Hack The Box Enigma Stats (Easy Linux)

Enigma is week 6 of Hack The Box Season 11, an easy Linux machine by 7u9y, worth 20 points and 585 XP. It is still active, so what follows is the season data and an honest read of the difficulty. No chain, no flags.

The numbers

Machine ID	915
Difficulty	Easy (20 pts / 585 XP)
OS	Linux
Released	2026-06-27 (week 6)
Maker	7u9y
Rating	4.3 / 5 from 371 reviews
User owns	9,100
Root owns	8,249
User → root drop	9.4%
User blood	3m 8s by ahos6
Root blood	17m 4s by s30s0ft

Community difficulty votes:

Bucket	Votes	Share
Easy	2,023	32.8%
Too Easy	1,894	30.7%
Medium	944	15.3%
Very Easy	386	6.3%
Bit Hard	292	4.7%

Total votes: 6,173.

Difficulty read

Enigma has the fastest user blood of the season at 3m08s, and then a 13m56s wait for root, an unusually wide gap for an Easy box, where the two normally land within a few minutes of each other.

At 4.3 stars it is also the best-rated Easy on the board, now that Silentium has retired. The difficulty votes sit comfortably in Easy and Too Easy (about 64% of 6,173), so the label is fair; the rating says people enjoyed the privesc rather than merely tolerating it.

A 9.3% user-to-root drop on an Easy is on the higher side, which fits the same story: the foothold is quick, and the step after it has an actual idea in it instead of a checklist item.

This is the Easy to do if you want to learn something. Reactor was the one to do if you wanted the points fastest, until it retired.

What to have ready

• Full TCP sweep first: nmap -p- --min-rate 2000 then a targeted -sC -sV on what answers. Easy boxes still hide the point of entry on a high port.
• Add the hostname to /etc/hosts the moment you see a redirect. Half the failed Easy attempts are people scanning an IP that only serves a vhost.
• Vhost and content discovery in parallel: ffuf with a subdomain wordlist against Host:, and feroxbuster for paths, with extensions matched to whatever the stack turns out to be.
• Read the source of every page you land on. Comments, JS bundles and .git leftovers carry more Easy footholds than any exploit does.
• For privesc: sudo -l before anything else, then linpeas, then SUID, capabilities, cron and writable service files, in that order.

When the writeup lands

We publish full chains after a box retires, never while it’s active, and we don’t hand them to anyone outside the team. Enigma retires at the end of Season 11, and the writeup goes up that week, in the same format as the HTB Down one.

If you’d rather not wait, the team’s internal notes go out in our Discord first. That’s also where people work through active boxes together, which is the part you’re actually allowed to do while Enigma is still live.

Related writeups

Retired Linux boxes we’ve already published:

• HTB Down Writeup
• HTB Manage Writeup
• HTB Reset Writeup